Talking to children about data and privacy online: …...and track your attendance and performance) 3. Data collected via your library card or school ID? Bus pass or Oyster card. CCTV

1

Talking to children about data and privacy online: Research methodology supplement

Please cite as: Livingstone, S., Stoilova, M. and Nandagiri, R. (2019) Talking to children about data

and privacy online: research methodology supplement. London: London School of Economics and

Political Science.

2

The project

With growing concerns over children’s online privacy and the commercial uses of their data, it is vital that children’s understandings of the digital environment, their digital skills and their capacity to consent are taken into account in designing services, regulation and policy.

This project seeks to address questions and evidence gaps concerning children’s conception of privacy online, their capacity to consent, their functional skills (e.g., in understanding terms and conditions or managing privacy settings online), and their deeper critical understanding of the online environment, including both its interpersonal and, especially, its commercial dimensions (including its business models, uses of data and algorithms, forms of redress, commercial interests, systems of trust and governance).

The project takes a child-centred approach, arguing that only in this way can researchers provide the needed integration of children’s understandings, online affordances, resulting experiences and wellbeing outcomes. Methodologically, the project prioritises children’s voices and experiences within the framework of evidence-based policy development by:

• conducting focus group research with children of secondary school age, their parents, and educators, from selected schools around the UK;

• creating an online toolkit to support and promote children’s digital privacy skills and awareness;

• organising child juries for evaluating resources to be included in the toolkit and reviewing recommendations for privacy and data-relevant policy and practice.

For details about the research methodology read:

Livingstone, S., Stoilova, M. and Nandagiri, R. (2019) Talking to children about data and privacy

online: research methodology. London: London School of Economics and Political Science. Available

here.

Contents

1) Children’s focus group – Schedule ...................................................................................................... 3

2) Children’s focus group – Activity 3 (Key words) ................................................................................. 9

3) Children’s focus group – Activity 4 (Types of data) .......................................................................... 14

4) Children’s focus group – Activity 5 (Advice to sibling) ...................................................................... 22

5) Children’s focus group – Activity 7 (Advice to sibling) ...................................................................... 23

6) Parents’ focus group – Schedule ...................................................................................................... 24

7) Parents’ focus group – Activity 3 (My child’s privacy protection) .................................................... 29

8) Teachers’ focus group – Schedule .................................................................................................... 30

9) Fieldwork forms ................................................................................................................................ 34

http://www.lse.ac.uk/media-and-communications/assets/documents/research/projects/childrens-privacy-online/Talking-to-children-about-data-and-privacy-online-methodology-final.pdf

3

1) Children’s focus group – Schedule

Activity 1: Introduction 10 minutes All together Need: - name

stickers - coloured

pens - audio

recorder

Hi, thanks for coming – we’re excited to speak with you! Does everyone have their consent form signed by you and your parent? [Check for and collect consent forms]

I’ll give you a name sticker – please write your FIRST name on it in BIG writing and stick it on you. [Hand out stickers and pens in 2 or 3 colours, put on own stickers and introduce ourselves]

We’re from the London School of Economics, a university in the middle of London. We’re audio-recording today’s discussion, as you can see. We’re interested to learn which apps and devices you use for the internet, and what you share about yourself online. What you say, together with other students around the country, will help us write a report for the government, and create an online toolkit for children and young people to learn about internet privacy. The aim is to make the internet a safer and better place. Today’s discussion will take about 1.5 hours. [Adjust as appropriate, depending on activities selected]

Everything we discuss today will stay completely confidential. Nothing will get back to your teachers or your parents. We’ll anonymise what you say when we write up our report. If there’s anything you don’t want to answer, that’s fine. Please keep what other people have said here confidential too. [Turn on audio-recorder]

So, what do you think this is going to be about? What comes to your mind when we say privacy and the internet? [Get them talking]

- What does it mean to be ‘private’ online? - Some people talk about ‘personal data’. Do you have ‘personal data’? What might that be? - Do you do anything to keep your privacy online? From whom? - Is privacy online important to you? What about offline?

Probes: What did your teacher tell you about what would happen today? Have you seen anything on the news recently about ‘privacy online’?

Activity 2: My apps, sites and privacy

First, we’d like you to list all the apps and websites you used over the last week. Use one post-it for each item. [Hand out packs of post-its, give them 5 minutes to work individually. Put A1 posters in the middle]

Apps: Gaming (Minecraft, Clash of Clans, Clash Royale, CRS racing, Fifa, Grand Theft

4

15 minutes All together Need: - post-its - pens - A1 posters

Please stick your post-its on the A1 posters in the middle – put them anywhere. [Invite explanations… what’s that for? … as they are sticking on their post-its]

- Have we missed any apps or websites? What about at school or other places you go? - How do you choose which apps to use? - Anything here you’ve just started using? - Anything that you were using before but not anymore? Why not? - When using an app/website for the first time, what are the things you want to know about it? - How do you decide which to trust? - Have you changed the default settings? Why? - Do you read their terms and conditions? Why? What are you looking for? - [Pick a popular app] What do you think should be the age to use this app? Why? - What is the right age to decide independently? - Among all these apps, do any have privacy settings that are easy to use? Any settings a problem?

Auto, Pokémon Go, Friv, Club Penguin, Roblox) Social media (Instagram, Snapchat, Twitter, Reddit, Pinterest, Facebook) Chat (Discord, Kik, Hangouts, WhatsApp, Viber, Skype) Live/web streaming (Musical.ly, Omegle, Tumblr, Steam, Twitch, Spotify, YouTube, Netflix) Selling/buying apps (Amazon, eBay, ASOS) Websites (Google, BBC Bitesize, for home, for school, school intranet, school homework site for fun, to register for something, for info…)

Activity 3: Privacy terms (optional) 15 minutes All together Need:

- - cards

Now let’s play a card game. I have a deck of cards – each has a word written on it. I will put them on the table one at a time. Please tell me if you have heard of the word and what it might mean. Most of the words are quite difficult, so it’s absolutely fine to say you haven’t heard of it or are unsure what it means.

[Place the cards on the table one by one, prompt for explanations of each, encourage the children who do not know it to say so]

- First time hearing this word? Unsure what it means? - Where have you heard/seen this word? - When did you first hear this word (how old were you then)? - What does it mean? What else do you know about it?

Cards: cookies, privacy settings, facial recognition, geo-location, digital footprint, dark web, algorithms, artificial intelligence, encryption

Activity 4:

Data cards 20 minutes

Now let’s think about the data we share online and who it is shared it with. I have 13 cards with different types of data. I will give them to you one at a time and you need to decide if you are happy to share this data with: 1) Your online contacts; 2) Your school, GP, future employer; 3) Companies (for advertising or profiling); or 4) You want to keep to yourself. You can put the same card in more than one place. [Check they understand; Give one data type (four identical cards) at a time; probe for explanations,

Probes: discuss these activities as they are done (purpose of this exercise is talk, not writing) 1. Your name? Age? Fake age? Photographs [showing what?], snaps,

5

Small groups (divide by pen colours into two groups) 1. Data given 2. Data given

by others 3. Data traces Need: - data cards - A1 posters

disagreements, variation within one card] [Put an A1 poster page in the middle to write additional notes] 1. Who would you share this with and why?

- How do you decide what to post (and where)? Why? What don’t you post or share? - Looking at all the data on the table, does that seem a lot about you, or not too much? - What else might you put in the ‘keep to myself’ pile?

2. Now, let’s think if we need to move some of the cards on the table. Think about all the information

that others share or post online about you. Let’s start with friends, other people at school. Who else? Parents? Teachers/the school? Doctor? [Check if cards need to be moved from ‘Keep to myself’] - How different is this to what you share? - Could anyone get information about you from what your friends share, even if they do not

mention you? - How do you feel about this? - Can you think of a situation where something was shared that you didn’t want shared? - Having to share a device?

3. Now, let’s think again if more cards need to be moved. Do your apps collect other information about

you, in addition to the things that you or others post on them? Maybe information that the apps and devices collect without you realising? [More prompting may be needed; check again about moving cards] - Do they track how long you use an app for? Do they know where you are? - What if you log into an app or website using a Facebook or Google login? - What if you use devices like internet-connected toys (e.g., drone), games console (Xbox), Smart

home devices (Alexa, Google Home), fitness tracker (Fitbit), VR headset? - What do they use this information they collect for? - Can it be used to target advertising to you? How?

locations, status updates, date of birth; check-in to places, on different sites. What if you do a quiz? 2. As above. Also sharenting, tagging. SIMS (computer where teachers record and track your attendance and performance) 3. Data collected via your library card or school ID? Bus pass or Oyster card. CCTV around the school Cookies and trackers. Geo-location, time zone, language, IP address, shop loyalty cards; being tracked via Google Maps? Facial recognition? Thumbprint to pay for dinner or unlock phone? Biometric? Biased algorithms? Personalise ads, offer games or promotions Analyse trends (data profiling, social credit score) Sell access to your data (data brokers) Prompt for understandings of the internet – who is they, how does it work, where’s the power?

Activity 5: Data profiling 10 minutes

Spontaneous reflections on data profiling: Do you think the internet can work out things that you may not have said directly?

- If we Googled your name, what could we find? - What can apps work out about you that you didn’t mean to tell them? - Can these apps ‘guess’ things about you like your favourite TV show or game? [How?]

Age, gender, education Who your friends are? What you like? Where you go, what you spend time on? Spending Health, ill health (e.g., asthma), learning difficulties

6

Still in groups but working individually Need: - worksheets

- How do you think they do that? Why? How long do they keep this info for? - Why is this information valuable to them? Why valuable to you?

So maybe the internet knows quite a lot about you! [Mix all data cards in one pile to show flow of info] It seems that the internet can work out things that you may not have said directly by using different types of data, including from other people like you. This is called data profiling. Companies and sometimes governments gather data from many people and match who you are like and then they can make predictions about you. [Explain and seek reaction] Further reflections on data profiling:

- Did you know this was possible? How do you think it works? - Who might do this profiling and why (what might they use it for)? - How do you feel about what the internet knows about you? - Anything you might be worried about (now/ future)? - Anything embarrassing? - It’s sometimes said that young people don’t care much about their privacy – do you agree? - Or that you’ll give away personal information to be able to use a site or app for free…? If an app

offers you money to track everything you do online, would you sign up? Harms:

- Does anything worry you about your online privacy? What? Why? What could go wrong?

- Have you been upset by something that someone else posted or shared about you? - Have you ever changed your mind about what you’ve posted? Or regretted it? - Can you think of an example where something has gone wrong? - Is there anything you can do to put things right when there’s a problem? - How might this affect you if trying to get a job in the future or a university place? - Data being hacked and shared for fraud? - Database mistakes and errors hard to put right

But maybe the internet doesn’t know everything, or gets some things wrong. Please write down: [Hand out worksheets]

1) Who the internet thinks you are 2) What it gets wrong about you

Religion, ethnicity, sexuality, politics Your parents’ politics? Or income? How you’re doing at school? What you search for? Browsing history… Focus: knowledge of data processing, flow, monetisation, profiling, data brokers, data intermediaries

7

3) Things it doesn’t know about you

Activity 6: Privacy strategies and support 15 minutes All together if group is small but stay in groups if large

Let’s think about some of things you do online to protect or control your personal information. [Prompt for lots of ideas]

- Maybe you’ve recently updated your privacy settings on your favourite apps? Discuss how/why - Are there things you do to control your information online? - Any clever tips? Do they work? How do you know? - Things your parents do to protect your privacy online? How do you feel about it? When should

you become independent? - Are there things you feel you can’t control or manage? (e.g., account with forgotten password)

Learning and help:

- Have you ever asked someone to help you with a problem (remove a photo, block someone, stop something being shared)?

- Who do you ask…? - Formal learning: any formal teaching (citizenship or computing class, PSHE)? - Informal learning: friends or family, online, just pick it up or work it out yourself?

Privacy tactics: Share passwords? Read privacy/cookie policy? Adjust privacy settings? Delete cookies? Use ad-blocker? Do not track? Use privacy-protecting browser? Unsubscribe, delete account? Stop using apps/sites/internet? Delete info/post less/? Refuse/post inaccurate personal info? Limit who can see your data? Use incognito windows The dark web (what’s that? How does it work?) Encrypted sites e.g., WhatsApp

Activity 7: Advise others OPTIONAL 5 minutes Need: - worksheets

Imagine that you have a sister or brother who is five years younger than you are. Think about all the things you would like them to know in the next five years, by the time they are your age. Write them a message, telling them all the things they should know about privacy and the Internet. [Hand out worksheets] [Summarise what they have said before moving to the next activity]

8

Activity 8: Questions? 10 minutes All together Need: - post-its - A1 posters

With everything you’ve shared with us today, you must have lots of thoughts and questions about how you use the internet! 1. What would you like to know about your online information and privacy? Can you write down

your questions? We’ll try to find the answers and create a resource for young people (and schools). [Hand out post-its. Stick up A1 poster (heading: ‘What I want to know’). Get them to put their post-its on the wall. Try to answer some of their questions as part of the conversation] OPTIONAL 2. Are there things that the people/companies who designed your apps and devices should do

differently to make privacy better? [Hand out post-its. Stick up A1 posters (heading: ‘What industry should do’). Put post-its on wall] - Should the industry (e.g., Instagram, Apple, Google), consult children when designing sites and

apps and devices? - What would you tell them?

Do you feel like you have enough information to help protect your personal privacy? Should companies be able to collect your data? Any kinds of data they shouldn’t be allowed to collect or keep? (sensitive? Facial recognition?) Should they change how people can tag you? Or how parents can monitor what you do online? Should they make it so parents to have to give consent to what you do online? Should there be a minimum age for some sites/apps? Which/what?

Activity 9: Thanks 10 minutes All together

Thank you! This was really interesting and helpful for us. We don’t know all the answers either, but we’ll find out what we can and we’ll send what we learn to your school.

- How did you find the discussion? Anything you enjoyed? - Anything we should change when we visit the next school – anything boring or unclear? - Anything that would be more interesting or fun?

Thanks for that! We’ll keep this in mind for the next time. If students and their parents have agreed to photographs, please stay for five more minutes before you leave. [Everyone take off their name stickers first]

9

2) Children’s focus group – Activity 3 (Key words)

Cookies

Privacy

settings

10

Facial

recognition

Geo-

location

11

Digital

footprint

Dark web

12

Algorithms

Artificial

intelligence

13

Encryption

14

3) Children’s focus group – Activity 4 (Types of data)

Share with

my online

contacts

15

Share with

my school,

doctor,

future

employer

16

Share with

companies

(advertising,

profiling)

17

Keep to myself

and not share

online

18

Internet searches

Search terms

Sites I visited

Clicked links

Personal information

Home address

Date of birth

Email address

Preferences

Films & music you like

Places you visit

Things you buy

19

Location

Using maps (on Google,

Snapchat)

Photo location

Being tagged in places

Social network

Family members

School friends

Friends of friends

20

Biometric data

Face recognition

Fingerprint

Voice recognition

School records

School grades

Attendance records

Detentions

21

Note: You need one copy of each mobile device image and four copies of

each data type card. Consider printing on coloured paper.

Health

Doctor’s records

Body weight

Mental health

Confidential information

Family income

Religion

How much you spend

online

22

4) Children’s focus group – Activity 5 (Advice to sibling)

What does the internet know about you? This is sometimes called your data shadow or data footprint. Write your answers below.

Are you a girl or boy? ………………………… How old are you? …………………

What kind of person does the internet think you are?

What doesn’t it know about you?

Might it be wrong about you in any way?

23

5) Children’s focus group – Activity 7 (Advice to sibling)

About you: Are you a girl or boy? ………………………… How old are you? …………………

Imagine that you have a younger sister or brother. What would you like them to know

about privacy online by the time they are your age? Write them a message in the space

below.

Dear younger sibling,

I think you should know a few things about privacy online:

1)

2)

3)

4)

24

6) Parents’ focus group – Schedule

Focus group discussions – parents

Activity 1: Introduction 10 minutes All together Need: - audio-

recorder - name

stickers

Hi, thanks for coming – we’re excited to speak with you! Does everyone have their consent form signed? [Collect consent forms]

We’re from the London School of Economics, a London university. We’re audio-recording what’s said today. We’re interested to learn from you which apps and devices do you use for the internet, and what you share about yourself online. What you say, together with other parents, teachers and students around the country, will help us to write a report for the government, and to create an online toolkit for children and young people to learn about internet privacy. The aim is to make the internet a safer and better place. Today’s discussion will take about 1.5 hours.

Everything we discuss today will stay completely confidential. We’ll anonymise what you say when we write up our report. If there’s anything you don’t want to answer, that’s fine. Please keep what other people have said here confidential too. [Turn on audio-recorder]

I’ll give you a name sticker – please write your FIRST name on it in BIG writing and stick it on you. [Hand out stickers and pens in 2 or 3 colours, put on own stickers and introduce ourselves]

Please introduce yourself and share something about the internet you find challenging as a parent. [Get them talking]

Activity 2: Devices, apps, sites 15 minutes All together Need: - post-its - pens - A1 posters

First of all, we’d like you to list all the devices that your family uses to get online. Use one post-it for each. [Hand out packs of post-its, give them 2 minutes to work individually. Stick A1 posters up] When you’re ready, please come and stick your post-its on the wall – put them anywhere. [Start discussing devices as they are sticking their post-its on the wall]

- Who uses this device? Shared or used on their own? What’s it used for? What might you get next? - Are there any issues with shared devices? E.g., younger kids getting recommendations from older? - Time spent online? Joint activities? - Monitoring what children do on these devices? (check phones, use software, track, follow them) - Privacy settings on these devices?

Apps and privacy practices – discuss together:

- Discuss what apps and websites children use. - How do children choose which apps to use? - When your child is using an app/website for the first time, are there things you want to know? - Do you read their terms and conditions? Why? What made you read these? - Check/change the default settings? - [Pick a popular app] What do you think should be the age to use this app? Why? - What is the right age to decide independently? Why? - Which services (apps/sites) do you trust? Why? How do you decide which to trust?

Tablets, smartphone, laptop Games consoles (PSP,DS, Xbox) Smart home device (Alexa, Google Home) Fitness tracker, VR headset Kindle, eReader, iPod touch, smart watch Internet-connected toys (drone) Apps: Gaming (Minecraft, Clash of Clans, Clash Royale, CRS racing, Fifa, Grand Theft Auto, Call of Duty, Pokémon Go, Friv, Club Penguin, Roblox) Social media (Instagram, Snapchat, Twitter, Reddit, Pinterest, Facebook) Chat (Discord, Kik, Hangouts, WhatsApp, Viber, Skype) Live/web streaming (Musical.ly, Omegle, Tumblr, Steam, Twitch, Spotify, YouTube, Netflix) Selling/buying apps (Amazon; eBay, ASOS) Websites (Google, BBC Bitesize, for home, for school, school intranet, school

25

- From the apps you use, do any have privacy settings that are easy to use? What makes them hard? - Any apps that you do not like the privacy settings of? Why? What would be better?

homework site for fun, to register for something, for info…)

Activity 3: Personal practices 10 minutes Separately Need pens, worksheet

Let’s think about some of your child’s privacy practices online. First, to be sure we’ve heard from everyone, and to get an idea of your own approach, please complete this sheet…. [Provide worksheet]

Activity 4: Support and learning 15 minutes Discussion, all together

Shared discussion: [Prompt for lots of ideas]

- Anyone want to share what they wrote down? - Maybe you’ve recently updated your child’s privacy settings or checked their favourite apps? Why? - Are there things you do to manage what they reveal about themselves online? - Any clever privacy tips and tactics? Do they work? How do you know? - How do your children feel about your actions in relation to their internet use?

Learning and help:

- Has your child ever asked you or someone to help with a problem (remove a photo, block someone, stop something being shared)? Did/would you know what to do?

- What do you think your child should know about online privacy? - Has your child received formal teaching about privacy online (citizenship or computing class, PSHE)? - Informal learning: friends or family, online, just pick it up or work it out themselves? - Do you feel like you have enough information to help protect your personal privacy? - Where do you get help about supporting your child regarding privacy? Any good resources? - Would you like more help? How/from who? Would you find an online toolkit helpful?

Privacy tactics: Share passwords? Read privacy/cookie policy? Adjust privacy settings? Delete cookies? Use ad-blocker? Do not track? Use privacy-protecting browser? Unsubscribe, delete account? Stop using apps/sites/internet? Delete info/post less/? Refuse/post inaccurate personal info? Limit who can see their data? Use incognito windows The dark web (what’s that? How does it work?) Encrypted sites e.g., WhatsApp

Activity 5:

Online data 20 minutes (stick a poster on the wall) All together

Thinking about the apps and devices that your child uses, let’s think about what kinds of information that they or others have shared or posted about them on the internet. 1. What do you think are all the different kinds of information your child has posted or shared about themselves [5 minutes – they call out, we write on a poster]

- Name? Fake name? - Age? Fake age? Date of birth? - Photographs [showing what?] - Locations, status updates, check-in to places; - Hobbies and interests (e.g., doing a quiz)

Probes: discuss these activities as they are done (purpose of this exercise is talk, not writing) Age, gender, education Who their friends are, what they ‘like’ Where they go, what they do online Spending Health, ill health (e.g., asthma) Learning difficulties Religion, ethnicity, sexuality, politics

26

4. Data given 5. Data given

by others 6. Data

traces

2. Now think about information that others, including you, share or post online about your child. [5 minutes – they call out, we add to the poster]

- When you share, who do you share it with and why? - Do you ask your child before sharing? - Occasions when they asked you to share something or remove something you posted? - Other family members? Their friends? - Teachers/the school (SIMS, school ID, CCTV in school, health records)? - Others: library card, Oyster card, doctor records? - How do you feel about this? - Can you think of a situation where something was shared that you didn’t want shared? - Who has control over what is shared? Should you have more/less control?

3. Now, let’s think about other information – data – collected about your child online. Maybe information that the apps and devices collect without you realising? [10 minutes – more prompting may be needed – they call out, we add to the poster]

- If we Googled your child’s name, what could we find? - Have you heard about Cambridge Analytica? Other news about privacy? - How easy or difficult is it to understand what is happening? Know what information is true? - Seen an upsurge of privacy emails (for social media, news, companies)? What did you do? - Data gathering you have opted out from (e.g., medical data with NHS)? - Have you heard of ‘cookies’? (what are they?) - Have you heard of ‘algorithms’? (what are they?) - What do you think apps/companies track about your child? - How long do they keep this info for? - What can apps work out about your child that they didn’t mean to tell them? - What do they use this information they collect for? - Has your child been exposed to personalised ads, games offers, other promotions?

Parents’ politics? Or income? How your child is doing at school? What they search for? Browsing history What is their grasp of ‘the internet’, online, databases, how the different data services connect up? 1. Cookies and trackers. Geo-location, time zone, language, IP address, shop loyalty cards. Being tracked via Google Maps? 2. Biometric: facial recognition? Thumbprint to pay for dinner or unlock phone?

3. Algorithms and profiling?

4. Personalise ads, offer games or promotions Analyse trends (data profiling, social credit score) Sell access to your data (data brokers)

Activity 6: Reflections and harms 20 minutes All together

Reflections on data practices and profile: - How do you feel about what the internet knows about your child? - Anything you might be worried about (now/future)? - How much of the above do you think children understand? How do their information-sharing

practices change as they grow older? And their grasp of the internet? By what age? - It’s sometimes said that young people don’t care much about their privacy – do you agree? - Or that they’ll give away personal information to be able to use a site or app for free?

27

- Are there things you feel you can’t control or manage? (e.g., account with forgotten password) - What kind of a role model are you for your child – as regards your internet/privacy practices?

Harms:

- Have you ever changed your mind/regretted what you or your child have posted? Has your child? - Has your child been upset by something that someone else posted or shared them? - Does anything worry you about your online privacy? What? Why? What could go wrong? Give an

example. Is there anything you can do to put things right when there’s a problem? Responsibility:

- Whose responsibility is it (children, parents, educators, government, companies)? - Are there things that the people/companies who designed your children’s apps and devices should

do differently to make privacy better? - Should the industry (e.g., Instagram, Apple, Google) consult children or parents when designing sites

and apps and devices? What would you tell them? - Should companies be able to collect your child’s data? Are there kinds of data they shouldn’t be

allowed to collect or keep? (Sensitive? Facial recognition?) - Should they change how people can tag others? Or how parents can monitor children?

Harms: Getting a job (or university place) Data being hacked and shared for fraud or grooming Database mistakes hard to put right Decisions based on biased algorithms Embarrassment, vulnerability, reputation problems Policy options on the table: - Minimum age for users (what?) - Mechanisms for redress - Regulations on profiling kids - Better/more parent advice - Include privacy in curriculum - Parent consent required by apps - Age verification (for kids or adults)


With everything you’ve shared with us today, you must have lots of thoughts and questions about how your child uses the internet! We want to give you an opportunity to share your questions or suggestions/recommendations. Can you write down your questions? We’ll try to find the answers and create a resource for young people (and schools). We would also appreciate some recommendations (for educators, regulators, other parents, policy-makers). [Hand out post-its. Stick up two A1 posters (heading: ‘What I want to know’ and ‘My suggestions’). Get them to put their post-its on the wall. Try to answer some of their questions as part of the conversation]

Activity 8: Thanks 10 minutes


- How did you find the discussion? Anything you enjoyed?

28

- Anything we should change when we visit the next school – anything boring or unclear? - Anything that would be more interesting or fun?


29

7) Parents’ focus group – Activity 3 (My child’s privacy protection)

We would like you to think about your child’s privacy online. Write your answers below.

What actions do you take to protect your child’s privacy online?

What actions do you expect your child to take to protect their own privacy online?

Who else should be responsible for protecting children’s online privacy and how?

How old is your child? ………… Girl or boy? ………….. How much do you think you know about the internet?

…………………………………………………

If you do paid work, can you describe your job? ………………………………………………………………………………………………………………….…………

30

8) Teachers’ focus group – Schedule

Focus group discussions – teachers

Activity 1: Introduction 10 minutes All together Need: - audio-

recorder - name

stickers

Hi, thanks for coming – we’re excited to speak with you! Does everyone have their consent form signed? [Collect consent forms]

We’re from the London School of Economics, a London university. We’re audio-recording today’s discussion, as you can see.

We’re interested to learn from you about how you think about the students’ online privacy and the commercialisation of children’s data. We’ll have questions about your roles, and the school’s approach. We’re also interviewing parents and children around the country. Our focus is on children aged 11–16 (Years 7, 9 and 11). We’ll be asking them which apps and devices they use for the internet, and what they share about themselves online. Also, what they understand about how their data is recorded and used online, by whom, what could go wrong, and what their rights are.

What you say, together with other students around the country, will help us to write a report for the Information Commissioner’s Office and to create an online toolkit for children and young people to learn about internet privacy. The aim is to make the internet a safer and better place. Today’s discussion will take about 1.5 hours.

Everything we discuss today will stay completely confidential. We’ll anonymise what you say when we write up our report, including the name of the school. If there’s anything you don’t want to answer, that’s fine. Please keep what other people say here confidential too. [Turn on audio-recorder]

I’ll give you a name sticker – please write your FIRST name on it in BIG writing and stick it on you. [Hand out stickers and pens in 2 or 3 colours, put on our stickers and introduce ourselves]

So, can I ask you to introduce yourself and explain your role at the school? [Get them talking, discover the expertise in the room]

Activity 2:

Types of data 10 minutes All together 7. Data given 8. Data given

by others 9. Data

traces

Thinking about the apps and devices that children use, let’s think about what kinds of information that they or others have shared or posted about them on the internet. We’re interested in what their data footprint might look like, and who contributes to it. 1. What do you think are all the different kinds of information children post or share about themselves: [5 minutes – they call out, we write on a poster]

- Name? Fake name? - Age? Fake age? Date of birth? - Photographs [showing what?] - Locations, status updates, check-in to places; - Hobbies and interests (e.g., doing a quiz)

2. Now think about information that others [e.g., their parents] share or post online about children. [5 minutes – they call out, we add to the poster]

Probes: discuss these activities as they are done (purpose of this exercise is to talk, not writing) Age, gender, education Who their friends are, what they ‘like’ Where they go, what they do online Spending Health, ill health (e.g., asthma) Learning difficulties Religion, ethnicity, sexuality, politics Parents’ politics? Or income? How a child is doing at school? What they search for? Browsing history. Cookies and trackers. Geo-location, time zone, language, IP address, shop loyalty cards. Being tracked via Google Maps?

31

Need:

- A1 posters

3. Now, let’s think about other information – data – collected about children online. Maybe information that the apps and devices collect without them realising? [10 minutes – more prompting may be needed – they call out, we add to the poster]

Activity 3: Professional experiences 10 minutes Individually Need: pens, worksheet

You all have different experiences and expertise. To be sure we’ve heard from everyone, and to get an idea of your own approach, please complete this sheet…. [Provide worksheet] We’ll discuss these issues you wrote about in turn….

Activity 4:

Privacy knowledge and teaching 15 minutes All together

Let’s start with how much do you think children understand about their online privacy? How do their information sharing practices change as they grow older? And their grasp of the internet? Let’s think about three year groups in turn: Year 7? Year 9? Year 11? [Take time over each] Privacy in the curriculum:

- What do you think children should know about online privacy? - Do children receive any formal teaching about privacy online (citizenship or computing class,

PSHE)? - Is this the best place for such teaching? What might be better? - Where does the curriculum support or materials come from? Are they good enough? - What is included and when (school year)? Can you give any examples? - What should be taught, is it, why/why not? - What works in teaching children about privacy online (Clever tips? How do you know what works?) - Do children’s learning needs change as they grow older? How? - What would be good tactics and advice to give children?

Privacy tactics: Share passwords? Read privacy/cookie policy? Adjust privacy settings? Delete cookies? Use ad-blocker? Do not track? Use privacy-protecting browser? Unsubscribe, delete account? Stop using apps/sites/internet? Delete info/post less/? Refuse/post inaccurate personal info? Limit who can see their data? Use incognito windows The dark web (what’s that? How does it work?) Encrypted sites e.g., WhatsApp

Activity 5: Harms and responsibility 15 minutes All together

Harms: - What could be the consequences of privacy problems for children? - Does anything worry you about your online privacy? What? Why? What could go wrong? - Can you think of an example where something has gone wrong? For you, or a student? - Is there anything you can do to put things right when there’s a problem? Tell us about it. - Other specific harms? To the school? To teachers?

Responsibility: - Whose responsibility is it (children, parents, educators, government, companies)? - What is the role and understanding of parents in supporting their children’s privacy online?

Getting a job in the future (or university place) Data being hacked and shared for fraud or grooming Database mistakes hard to put right Decisions based on biased algorithms Embarrassment, vulnerability, reputational damage

Policy options on the table:

32

- Are there things that the people/companies who design apps and devices that children use should do differently to make privacy better?

- Should industry do something to help educators teach about privacy online? What? - Should companies be able to collect children’s data? Are there kinds of data they shouldn’t be

allowed to collect or keep? (Sensitive? Facial recognition?) - What considerations apply to vulnerable children? - What about the policy options on the table?

- Minimum age for users (what?) - Mechanisms for redress - Regulations on profiling kids - Better/more parent advice - Include privacy in curriculum - Parent consent required by apps - Age verification (for kids or adults)

Activity 6: Schools approach to privacy 15 minutes All together

Now we’d like to discuss the school’s approach to students’ privacy.

Data gathered about students: - What data does the school gather about its students? - What is the purpose of the data? How is it used? - How is this data stored? Security and access to it? - How long is it stored for? Can students/parents opt out? - How are parents informed about the data gathering? Consent? - Does the school have a privacy policy? Discuss… - Who makes the decisions about this policy? - Is student data shared with third parties? How/why? - If the school uses any online learning platforms (e.g., Class Dojo) do you know what data these

collect about children? - When you use apps for learning, do you check their default privacy settings/terms and conditions? - How do you think about the trade-off between free/cheap software and data monetisation? - Are the students involved in the school’s privacy policy? Or the parents? Why/how/why not? - What are the key privacy-related challenges for the school at the moment? Have these changed? - Becoming a Google school – what is the thinking behind this? - Could a school be a model in treating kids’ data respectfully, so that kids learning high expectations

to apply to rest of life? Data gathered about staff:

- What data is gathered about staff? How it is used/accessed? - How do you feel about the school collecting and handling your data?

SIMS (or other school information management system, where teachers record and track students’ attendance and performance) Data collected via the library card School ID Thumbprint CCTV around the school Photos/leavers books Health, ill health (e.g., asthma), learning difficulties Family’s financial situation Religion, ethnicity, sexuality

Activity 7: Support and learning 10 minutes

Let’s think about some support for children, teachers, and parents. [Prompt for lots of ideas] Informal learning and help:

- Do you think that children and/or parents worry about privacy online? In what way? - Have you ever spoken to children about online privacy outside the curriculum topics? What

prompted this? Why not? - Have any children or parents ever come to you for any advice related to privacy online?

33

All together

- Have you spoken to other teachers at the school about privacy online? - Have any children ever asked you for help with a privacy problem (remove a photo, block someone,

stop something being shared)? Did/would you know what to do? What would you do? - Examples of things you have advised or would like to advise children about online privacy?

Teachers’ support:

- Do you feel like you have enough information to help children protect their personal privacy? - Have you had any formal training about privacy online (in the school, elsewhere)? - Where do you get help about supporting children regarding privacy? Any good resources? - Would you like more help? How/ from who?

Toolkit: Would you find an online toolkit helpful? What should be included in it?


With everything you’ve shared with us today, you must have lots of thoughts and questions about how children use the internet! We want to give you an opportunity to share your questions or suggestions/recommendations. Can you write down your questions? And your suggestions? We’ll try to find the answers and create a resource for young people (and schools). We would also appreciate some recommendations (for educators, regulators, other parents, policy-makers). [Hand out post-its. Stick up two A1 posters (heading: ‘What I want to know’ and ‘My suggestions’). Get them to put their post-its on the wall. Try to answer some of their questions as part of the conversation]

Should companies be able to collect your data? Any kinds of data they shouldn’t be allowed to collect or keep? (sensitive? Facial recognition?) Should they change how people can tag you? Or how parents can monitor what you do online? Should they make it so parents to have to give consent to what you do online? Should there be a minimum age for some sites/apps? Which/what?

Activity 9: Thanks All together 5 minutes


- How did you find the discussion? Anything you enjoyed? - Anything we should change when we visit the next school? Anything boring or unclear?


34

9) Fieldwork forms

[Information sheet students and parents]

Children’s data and privacy online:

Growing up in a digital age

Dear student,

We would like to invite you to join a discussion about young people’s privacy and the

internet, as part of our research project.

Your contribution, together with other students around the country, will help us to create an

online toolkit for children and young people to learn about internet privacy. The results will help

teachers, parents and the government to make the internet a safer and better place.

We hope you are interested in taking part!

What will happen when you take part?

You will join a group discussion with up to 10 other students from your Year group. It will take

about 1.5 hours, and it will be fun and informative! We will ask:

• Which apps and devices do you use for the internet?

• What do you share online about yourself?

• Who can see your messages or know what you do online?

• What can you do to manage your digital privacy better?

Our discussion will be audio-recorded to help us remember what was said. Everything will be

made anonymous, and you won’t be identifiable. So we will not use your real name or the name

of your school or neighbourhood. If you say something that suggests you are at serious risk we

may need to protect you and let the appropriate authorities know. We will tell you if we need to

do this.

Returning the consent form

Participation in the research is voluntary. It’s fine if you don’t want to take part.

If you agree to participate, please sign the consent form. Please ask your parent or guardian to

read this letter and ask them to sign to say you can participate too.

35

Getting in touch

If you have any questions about the project you can contact us anytime:

• [Name of researcher] [email], [phone number]


You can ask us for a copy of your data or let us know if you no longer want to be part of the research. Read about our project here: [link]

Thank you for your valued time and participation!

All the best,

[Signature]

https://bit.ly/2w21kf1

36

[Consent form students and parents]

Children’s online privacy and commercial use of data:


STUDENT CONSENT FORM

Thank you for agreeing to participate in our research on online privacy. Please fill in this form. You need

to return the signed form to your school or the project team.

I have read the information sheet and have understood about the research.

(please tick)

I know that the research is voluntary and will not result in any different treatment from the school. I know that I do not need to answer any question I do not wish to, and can leave the research at any time.

(please tick)

I agree to participate in the group discussion and for it to be audio-recorded.

(please tick)

I understand that my responses will be kept confidential and anonymous, and that this consent form and the audio-recording will be kept securely for 10 years.

(please tick)

I have my parent’s permission to participate in this study.

(please tick)

We would like to take photos at the end of the discussion for when we present the findings in public. Your face may be visible but we would not link it to your name. May we do this?

If you say no, that’s fine and you can still join the discussion group.

Yes

No

Your name:

Your age:

Your class:

Signature:

Date:

Thank you very much!

Please show the other side of this page to your parents – ask one of them to complete it and sign at the

bottom.

37



PARENT CONSENT FORM

Thank you for agreeing that your child may participate in our research on online privacy. Please fill in this

form and give it to your child to return to the school or the project team.


(please tick)

I know that the research is voluntary and will not result in any different treatment from the school. I know my child does not need to answer any question they do not wish to, and can leave the research at any time.

(please tick)

I agree that my child can participate in the group discussion and for it to be audio-recorded.

(please tick)

I understand that my child’s responses will be kept confidential and anonymous, and that this consent form and the audio-recording will be kept securely for 10 years.

(please tick)

We would like to take photos at the end of the discussion for when we present the findings in public. Your child’s face may be visible but we would not report their name. May we do this?

If you say no, that’s fine and your child can still join the discussion group.

Yes

No

Your name:

Your child’s name:

Your child’s class:

Signature:

Date:


We will make the research results available in 2019, and we will let the school know. Feel free to contact

us if you wish to know more.

38

[Information sheet teachers and parents]



For teachers and parents

Dear teachers and parents/guardians,

We would like to invite you to join a discussion about young people’s privacy and the

internet, as part of our research project, in the week beginning [date].

Your contribution, together with other teachers, parents and students around the country, will

help us to create an online toolkit for children and young people to learn about internet privacy.

The results will help teachers, parents and the government to make the internet a safer and

better place.

We hope you are interested in taking part!

What will happen when you take part?

You will join a group discussion with up to 10 other teachers or parents from the school. It will

take about 1.5 hours, and it will be fun and informative! We will ask:

• Which apps and devices do children use for the internet?

• What do they share online about themselves?

• Who can see their messages or know what they do online?

• What can children do to manage their privacy online better?

• What can teachers and parents do to help children improve their privacy online?

Our discussion will be audio-recorded to help us remember what was said. Everything will be

made anonymous, and you won’t be identifiable. So we will not use your real name or the name

of your school or neighbourhood.

Returning the consent form

Participation in the research is voluntary. It’s fine if you don’t want to take part.

If you agree to participate, please sign the consent form.

39

Getting in touch

If you have any questions about the project you can contact us anytime:



You can ask us for a copy of your data or let us know if you no longer want to be part of the research. Read about our project here: [link]

Thank you for your valued time and participation!

All the best,

[Signature]

https://bit.ly/2w21kf1

40

[Consent form teachers]



TEACHER CONSENT FORM


to return the signed form to the school or the project team.


(please tick)


(please tick)


(please tick)

I understand that my responses will be kept confidential and anonymous and that this consent form and the audio-recording will be kept securely for 10 years.

(please tick)

Your name: ___________________________________________

Signature: ___________________________________________

Date: ___________________________________________


41

[Consent form parents]



PARENT CONSENT FORM


to return the signed form to the school or the project team.


(please tick)


(please tick)


(please tick)

I understand that my responses will be kept confidential and anonymous and that this consent form and the audio-recording will be kept securely for 10 years.

(please tick)

Your name: ___________________________________________

Signature: ___________________________________________

Date: ___________________________________________


42

[School invitation letter]

Children’s data and privacy online:


To

NAME, Headteacher

NAME OF SCHOOL

[date]

Dear NAME,

We are writing in the hope that your school will participate in our research on children’s data and privacy online.

Our aim is to learn from children’s understandings to guide policy-makers, educators and businesses in

supporting children’s rights to privacy and to protect them from privacy risks when they use the internet.

We wish to conduct focus group discussions with children to explore children’s experiences of the internet, and

their understanding of online privacy and data issues. Ideally, we would like to visit your school for one day, to

hold three discussion groups, one each with children from Years 7, 9 and 11. Each group would include 8–10

children and last about two school periods or 1¼ hours.

The session will be designed to be interactive, fun and informative for the children. The questions will be about

how they use the internet, what they think about their privacy online, what they know of how their data may be

used, what can go wrong and why, and the resources available to help them protect their privacy online.

The research is funded by the Information Commissioner’s Office. We will use the research results to construct an

online toolkit for children to learn about online privacy. This will be made available nationally.

The research team is based at the Department of Media and Communications, London School of Economics and

Political Science (LSE). The project has been approved by the LSE Research Ethics Committee (REC 000710) and

the researchers are recently DBS checked (available on request).

43

If practical, we would also like to hold a group discussion with parents and one with teachers to discuss their

views on supporting children’s online privacy.

Individual information about participants will not be shared with people outside the research project, and will be

securely stored. Your school and individual participants will not be identifiable and all reporting will be

anonymised. We are happy to share our parent leaflet, consent form and or any other information that would be

helpful.

We hope to conduct the research in September or October 2018 but we can accommodate our plans to fit the

school.

We know that school timetables are very full, but this is important research and we hope you can help us. We

would be delighted to share the results with the school in due course.

Thanks so much for considering this request, and we will be in touch shortly.

Yours sincerely,

[Signature]

Key contacts:



You can read more about our project here: [link]

Documents

Talking to children about data and privacy online: …...and track your attendance and performance) 3. Data collected via your library card or school ID? Bus pass or Oyster card. CCTV